agenttesla

General

Target

4cb5158bf0867f8d1990aac298da8f9a3aef98f1cb99065b44e1ceb1e2908396.vbs
Size

279KB
Sample

240419-bqr1psce49
MD5

ed94a32330d4f8bc01426f17de225782
SHA1

c615ead1fc2f00fdff3478a340df3e7dd883bd66
SHA256

4cb5158bf0867f8d1990aac298da8f9a3aef98f1cb99065b44e1ceb1e2908396
SHA512

e28bc052d8de44e020196f80b6b42452c16891d8b2294fb39876448ed77210ba75c5d729c98ab91b7f82aea8fd36d0bdd404b3a53041a43edbaace104f58d3ac
SSDEEP

6144:L3dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOEG8xYI8tEi:LnS2ImLYp8Wjn2t

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.myhydropowered.com
Port:
587
Username:
ark@myhydropowered.com
Password:
A5kVzQi5I7SdQz6
Email To:
redbull@myhydropowered.com

Targets

- Target
  
  4cb5158bf0867f8d1990aac298da8f9a3aef98f1cb99065b44e1ceb1e2908396.vbs
- Size
  
  279KB
- MD5
  
  ed94a32330d4f8bc01426f17de225782
- SHA1
  
  c615ead1fc2f00fdff3478a340df3e7dd883bd66
- SHA256
  
  4cb5158bf0867f8d1990aac298da8f9a3aef98f1cb99065b44e1ceb1e2908396
- SHA512
  
  e28bc052d8de44e020196f80b6b42452c16891d8b2294fb39876448ed77210ba75c5d729c98ab91b7f82aea8fd36d0bdd404b3a53041a43edbaace104f58d3ac
- SSDEEP
  
  6144:L3dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOEG8xYI8tEi:LnS2ImLYp8Wjn2t
Score

10^/10

agenttesla guloader downloader keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Blocklisted process makes network request

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2